Windows BitLocker Encryption
Manage Keys and Encrypt Machines with DriveStrike
Windows BitLocker Encryption
Windows BitLocker Encryption is easy to set up with DriveStrike, and it is a simple and effective way to encrypt and protect your fleet of Windows machines. Below you will find some information and instructions to help you get a good idea of how DriveStrike enables you to configure BitLocker integration and keep devices secure, all from one central console.
Start a free trial to start encrypting your Windows machines and managing keys through DriveStrike, and feel free to contact us if you have questions or need any help. If you have a large number of machines, check out our Windows Mass Deployment guide for setting up DriveStrike.
Encrypt on Command
Escrow Keys
Rotate Keys & Lock
Persist BitLocker
Start Your Free 30-Day Trial
Your organization needs simple and wide-reaching solutions to combat daily security challenges. DriveStrike helps you protect your most critical data with premium quality endpoint security.
Encrypt Windows devices you manage
BitLocker Integration Overview
With DriveStrike's Windows BitLocker integration, deploying and enabling whole drive encryption has never been easier. DriveStrike provides added data security at no additional cost while easing the deployment and management of encryption keys. DriveStrike supports BitLocker deployment and encryption for Trusted Platform Module (TPM) devices as well as older, non-compliant hardware.
Windows Remote Encryption Pre-requisites:
- Windows 8 or 10 with a valid BitLocker license.
- BitLocker is available on Windows Pro, Ultimate, Enterprise, and Education editions.
DriveStrike will confirm BitLocker availability upon device registration, and display "Enable" in the DriveStrike Device Details page for supported devices.
Selecting "Enable" on the DriveStrike Device Details page encrypts all your physical internal hard drives and escrows a recovery start up key file that can be used to boot the machine and access the encrypted data. DriveStrike reports the progress of drive encryption in the Details section of the Device page.
Devices that are encrypted will be noted in the Dashboard with the following icon: 
Encrypt a Windows Device in 3 Easy Steps:
1. Log In to DriveStrike
When you log in to your account, your Dashboard will show you all the devices you manage at a glance. You can search for the device if you manage a large number of devices.
2. Click on the Device
On the Device Page, you will see information about the device, available actions, and a history of actions. You can also see a map showing the last known location of the device.
3. Click "Enable"
DriveStrike will encrypt the device's hard drive and escrow keys. A link to download the recovery key for each encrypted drive is displayed in the Device Details section.
TPM and Non-TPM Machines supported
DriveStrike Features for Windows Encryption
Using BitLocker with TPM Machines
If your machine supports TPM (most newer hardware does) you will not be asked to enter a passcode or provide an external key to boot the machine. Essentially, the Windows user login and general experience remains unchanged, but the data is secure and protected from unauthorized access. If you want to learn more about TPM and how the TPM security model was built to minimize user annoyance while improving security, please visit Windows Trusted Platform Module Technology Overview.
Using BitLocker with Non-TPM Machines
If your machine does not support TPM, DriveStrike will require that you provide a passphrase that will be used to encrypt the data on the machine. This passphrase is required to boot the machine from this point forward until BitLocker is disabled. The passphrase option and TPM are mutually exclusive, so if your machine has a TPM, you will not be able to set a passphrase, and if it does not have a TPM, you will need to set a passphrase.
Additional Features
Escrowed Recovery Key – DriveStrike retains a copy of the recovery key file for all machines that have BitLocker enabled through DriveStrike. This ensures that administrators have an encryption key to unlock encrypted data when needed. A link to download the recovery key for each encrypted drive is displayed in the Device Details section within DriveStrike.
Stored Passphrase – When a passphrase is used to encrypt data, DriveStrike stores and displays the passphrase next to the associated drive within the Device Details section.
Additional Lock Option – Administrators can optionally force recovery mode through DriveStrike Remote Lock. Forced recovery mode removes the TPM key and requires a passphrase or an external key file to boot the machine and access the encrypted data. Downloading the DriveStrike escrowed key to the root of a USB drive prepares the USB to be used at boot to unlock the machine.
Change Encryption Key – Administrators can change the passphrase or recovery key for any drive. This allows Administrators to securely lock out insiders while retaining access to the data on the machine (assuming the physical hardware is not destroyed).
Disable Encryption – Administrators can remotely disable encryption for the physical drives on the machine.
DriveStrike – Data Breach Protection
Respond to cybersecurity threats and encrypt Windows devices. Start a free trial today to find out if DriveStrike is the premium security solution your business has been looking for.
